Digiwin EasyFlow .NET SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Digiwin's EasyFlow .NET application, specifically in versions 6.1.x, 6.6.x, 8.1.1, and 8.1.2. This vulnerability allows unauthenticated remote attackers to inject arbitrary SQL commands, which could be used to read, modify, or delete database contents.

Impact

Exploitation of this vulnerability allows for arbitrary SQL injection, enabling attackers to manipulate database contents potentially leading to unauthorized data access, modification, or deletion.

Remediation

Users can update to EasyFlow .NET version 8.1.3 or later, or apply the patch released on January 20, 2026.